James Coombs v The Information Commissioner [2026] UKFTT 785 (GRC)

[2026] UKFTT 00785 (GRC)

Case Reference: EA/2025/0298

First-tier Tribunal

(General Regulatory Chamber)

Hearing Heard on: 8 th December 2025

Date 2 June 2026

Information Rights

Decided without a hearing

Before

JUDGE KIAI

MEMBER COOK

MEMBER WOLF

Between

JAMES COOMBSAppellant

THE INFORMATION COMMISSIONERRespondent

Decision: The appeal is Allowed.

1.1 The Appellant requested, in respect of each candidate who sat the Kent Test in September 2024, raw scores and standardised scores in each of the three sections, together with the candidates’ date of birth, subject to an express anonymisation safeguard excluding any results where fewer than five children shared the same birth date.

1.2 The Tribunal finds that the Council was not entitled to rely on section 40(2) FOIA to withhold the requested information, when disclosed in appropriately anonymised form consistent with the request.

1.3 The Tribunal therefore substitutes this Decision Notice under section 58(1)(a)(ii) FOIA.

Substituted Decision Notice:

3.Steps required

3.1 The Council must disclose to the Appellant the following information for candidates who sat the Kent Test in September 2024:

(a) raw scores in each of the three sections (English, Maths and Reasoning);

(b) standardised scores in each of the three sections (English, Maths and Reasoning);

3.2 In complying with paragraph 3.1(c), the Council must apply the safeguard expressly contained in the request, namely:

•The exclusion or redaction of any any results where fewer than five candidates share the same birth date, so that no date of birth appearing in the disclosed dataset is associated with fewer than five candidates.

3.3 In addition, because the request expressly contemplated exclusion of candidates outside the normal cohort age range to avoid identification risk, the Council must:

(a) remove from the disclosed dataset any candidates who were outside the normal cohort age range for Kent Test sitting in September 2024 (older/younger out-of-cohort candidates); and

(b) disclose, alongside the dataset, a count of the number of candidates removed on that basis.

3.4 The information must be disclosed in a single dataset (for example, a spreadsheet), with one record per candidate and clear column headings corresponding to the fields in paragraph 3.1.

3.5 The Council is not required to create new information. Its obligation is to disclose the information it holds falling within the scope of the request, subject only to the exclusions in paragraphs 3.2–3.3 which give effect to the request’s anonymisation safeguard.

4.1 Time for compliance

4.1 The Council must comply with paragraphs 3.1–3.4 within 42 days of the date on which this decision is issued.

5.Enforcement / certification

5.1 Any failure to comply with this Substituted Decision Notice may result in certification by the Tribunal to the Upper Tribunal under rule 7A of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended) and may be dealt with as a contempt of court.

REASONS

[1]This is an appeal under section 57 of the Freedom of Information Act 2000 (“FOIA”) against a decision notice (“DN”) issued by the Information Commissioner (“the Commissioner”) on 9 July 2025 (reference IC-351234-R4H2).

[2]By that DN, the Commissioner concluded that Kent County Council (“the Council”) was entitled to withhold the requested information under section 40(2) FOIA on the basis that disclosure would involve the unlawful processing of third-party personal data.

[3]For the reasons that follow, the Tribunal concludes that the DN is not in accordance with the law. PROCEDURAL HISTORY (1). Requests

[4]On 6 November 2024, the Appellant made a request to the Council under FOIA seeking information relating to candidates who sat the Kent Test in September 2024.

[5]The request sought, was framed in the following terms (material parts): the Appellant stated that he understood candidates were given three standardised scores in English, Maths and Reasoning, and requested, for each candidate who sat the test in September 2024: (a) raw scores in each of the three sections;(b) standardised scores in each of the three sections; and(c) the candidate’s date of birth.

[6]The request explicitly acknowledged the risk of identification in small categories and claimed to build in a safeguard: it sought disclosure of the candidate’s date of birth “[excluding] any results where less than five children share the same birth date”.

[7]In the request as recorded in the Commissioner’s investigation correspondence, the Appellant further emphasised that some children sit the test outside the normal cohort age range, asked for such results to be removed, requested a count of those removed, and asked that the Council not provide information capable of identifying individual candidates. (2) Council’s Response

[8]The Council responded on 15 November 2024 (reference 52853316). It refused the request on the basis that disclosure would breach the Data Protection Act 2018 (unlawful processing of personal data) and therefore fell outside its disclosure obligations by virtue of section 40(2) FOIA.

[9]The Council’s refusal included the following central reasoning:

“Even without any dates of birth, the combinations of three standardised scores are unique enough each year that many people would be able to identify their own child’s data in such a report.”

[10]The Council therefore treated section 40 (2) as applying not merely to the requested dates of birth, but also (in practical effect) to the dataset of raw and standardised scores as a whole, on the basis that the combination of three standardised scores was sufficiently unique to permit identification (including self-identification).

[11]The Council advised the Appellant of his right to seek an internal review and thereafter, to complain to the Information Commissioner. (3). Review

[12]On 16 November 2024, the Appellant requested an internal review. In doing so, the Appellant expressly criticised the Council’s reliance on self-identification, describing the Council’s position as effectively asserting that “because parents already know their child’s score, they will be able to discover their child’s score”, and stating he was “at a loss to understand what point is trying to be made.”

[13]The Appellant drew the Council’s attention to the decision in James Coombs v Information Commissioner and the Lincolnshire Consortium of Grammar Schools (EA/2022/0245) (referred to as “Lincolnshire” throughout this decision) and extracted the Tribunal’s discussion of identifiability and the “motivated intruder” approach, including the Tribunal’s statement that the “motivated intruder” starts without prior knowledge and would need to undertake substantial investigative steps; and the Tribunal’s conclusion that the likelihood of identification was “very remote and too remote” to satisfy the legal test in Department of Health v ICO and ICO v Magherafelt.

[14]The Appellant then applied that reasoning to the Kent Test cohort. He asserted that, with around 8,000 candidates, there would be around 20 or so children sharing each birth date, and explained that this was why he stipulated redaction of any birth date shared by fewer than five candidates; he challenged the Council to explain how a motivated intruder could identify the relevant group of candidates and persuade them to disclose scores, or else disclose the information.

[15]The Council issued its internal review outcome on 11 December 2024, stating that it was correct to withhold the information under section 40(2) FOIA. It recorded that the Admissions team explained:

“when combining standardised, raw scores and dates of birth, 16369 of the 16388 permutations occur so infrequently that they fall below the threshold of 5 or less that we use to indicate a high risk of an individual identifying their own data … 12500 of the permutations are completely unique within the dataset.”

[16]The internal review further stated that following a complaint to the ICO in January 2018, the ICO advised the Council that disclosure of that level of detail had allowed identification and that Council had breached the Data Protection Act 1998; and, taking that advice into account (together with its current obligations under DPA 2018 and UK GDPR), the Council considered disclosure would be likely to enable identification “not only by others but also themselves.”

[17]The internal review cited Article 5(1) UK GDPR and concluded disclosure would breach “lawfulness, fairness, transparency”, and therefore section 40(2) FOIA applied.

[18]The Appellant subsequently made a complaint to the ICO, who undertook an investigation. (4). Decision Notice

[19]The Commissioner issued a DN dated 9 July 2025. The Commissioner’s decision was that the Council was correct to withhold the information under section 40(2) FOIA and no steps were required.

[20]Under “Scope of the case”, the Commissioner noted the Appellant’s argument that suitable redactions could anonymise the data and that the request “clearly stipulated” that redactions should be made to allow anonymised disclosure; however, the Commissioner stated that he “must consider whether the council was correct to apply section 40(2) to the information which was actually requested”, because the council is required to respond to the request made and is not required to “work out what information, similar to that requested, would not be personal data.”

[21]Under “Reasons for decision”, the Commissioner set out the section 40(2) framework and identified the relevant condition as section 40(3A)(a): whether disclosure to any member of the public would contravene a data protection principle (Article 5 UK GDPR). The Commissioner stated the two-step structure: first, determine whether the information is personal data under DPA 2018; second, only if it is personal data, determine whether disclosure would breach a data protection principle.

[22]On the question “Is the information personal data?”, the Commissioner concluded that there were scenarios in which it was “likely” individuals could be identified from the requested information. He gave examples:(a) where a child has shared a score with another child or a third-party parent who also knows the child’s birth date; if the combination of birth date and known score is unique, the parent could identify the child in the dataset and learn the child’s other scores; and

(b) where a child has told third-party parents a score that is unique (e.g. very high/low), the child would be identifiable, and the other scores and date of birth would be relatable to that child.

[23]The Commissioner concluded that the information, combined with existing knowledge held by some individuals, would allow individual children to be identified; accordingly, the requested information fell within the definition of personal data in section 3(2) DPA 2018.

[24]On Article 5(1)(a) (“lawfulness, fairness, transparency”), the Commissioner identified Article 6(1)(f) (“legitimate interests”) as the most applicable lawful basis, and set out the three-part test (legitimate interest; necessity; balancing).

[25]On legitimate interests, the Commissioner concluded that the public had a legitimate interest in disclosure because the data would allow greater transparency and oversight of the Kent Test and an “oversight on where individual children sit within that test in terms of school offers and placements” to those with an interest in the results.

[26]On necessity, the Commissioner stated that “necessary” means more than desirable but less than indispensable; that it involves consideration of alternative measures; and that disclosure under FOIA must be the least intrusive means of achieving the aim. The Commissioner concluded disclosure was necessary and that there were no less intrusive means of achieving the identified aims.

[27]On balancing, the Commissioner identified factors including harm/distress, whether information is already public/known to some, expressed concerns, and reasonable expectations. He concluded that children would have no expectation that their test results and birth dates would be disclosed “to the whole world” in response to an FOIA request and that this expectation was reasonable.

[28]The Commissioner concluded that disclosure would cause distress to children who could be identified, giving the example of a child with poor results not wishing their scores to be published to the whole world in a manner permitting identification. He acknowledged some individuals may already know relevant information where parents/children chose to share details but stated FOIA disclosure is “far wider” than limited disclosure chosen by each child/parent.

[29]The Commissioner concluded that, while there was public value in the requested information, disclosure that would allow identification would be an unwarranted intrusion into rights and freedoms; the legitimate interest was insufficient to outweigh children’s fundamental rights; there was no Article 6 basis; and disclosure would therefore be unlawful. Accordingly, section 40(2) applied.

[30]Under “Other matters”, the Commissioner noted the Appellant’s anonymisation arguments but stated the Appellant could “remake” the request, reworded to avoid disclosure of personal data, if he wished. (5) Grounds of Appeal

[31]The Appellant lodged his appeal using form GRC1, dated 9 July 2025.

[32]In his “Reasons for your appeal” (Section 8), the Appellant summarised his challenges as follows:(a) the Commissioner’s two-step process required, at step 1, personal data findings; the Commissioner’s own findings were that disclosure would “likely” lead to identification; however, Judge Jacobs’ decision in NHSBSA v IC and Spivack required actual identification;

(b) at step 2, the Commissioner failed to establish legitimate interests and exaggerated the impact;

(c) the decision notice invited a reworded request but did not explain how and did not require the Council to provide advice/assistance under section 16 FOIA.

[33]Under “Outcome of appeal” (Section 9), the Appellant invited the Tribunal to issue a substituted decision notice ordering the Council to disclose anonymised scores including dates of birth; to conclude the likelihood of a motivated intruder identifying candidates where each date of birth is shared by 45 candidates is very remote (relying on Department of Health v ICO and ICO v Magherafelt); and to conclude that legitimate interests provide an overwhelming argument for disclosure. (6) Commissioner’s Response

[34]The Commissioner’s formal response under rule 23 was dated 10 September 2025. The Commissioner opposed the appeal.

[35]The Response set out the statutory framework: section 1 FOIA (right of access) and the relevant exemption section 40(2) FOIA; it adopted the DPA 2018 definition of personal data and the Recital 26 GDPR test for identifiability (“all the means reasonably likely to be used”).

[36]The Response cited the Article 29 Working Party guidance (Opinion 4/2007) that mere hypothetical possibility is not enough; if, taking account of all means likely reasonably to be used, the possibility of identification is negligible, the person should not be considered identifiable.

[37]The Response adopted the ICO “motivated intruder” approach as set out in ICO guidance on anonymisation and noted that similar approaches have been adopted by the Upper Tribunal in Magherafelt, Miller and Morton. It cited Breyer for the proposition that the risk should “in reality… be insignificant”.

[38]The Response relied upon NHSBSA v IC and Spivack in the FTT (EA/2019/0407) and the UT (

[2021] UKUT 192 (AAC)

), noting the requirement for a “degree of certainty”, that information must allow one individual to be distinguished from others, that correctly guessing is insufficient, and that a “reliable connection” is required rather than an educated guess.

[39]On time-slice, the Response relied on Keighley and Montague and stated the relevant time was 15 November 2024, the date of the Council’s response.

[40]On Ground 1, the Response refuted the Appellant’s contention that the Commissioner proceeded on “likely identification” contrary to Spivack. It emphasised that the Appellant sought DOB and score information for each candidate; it cited the Council’s internal review statement about permutations and uniqueness; and it submitted that it was reasonably likely that at least one member of the public (including a third-party parent) would be able to correctly identify a candidate from the requested information and other information known/available, thereby learning new information; and that unique score combinations could permit identification, not only DOB.

[41]The Response distinguished Spivack on the basis that, in that case, there were multiple reasons a person might appear in the dataset, whereas here there was no reason for candidates to appear save that they took the Kent Test. It further relied on FOIA disclosure being effectively “to the world”, citing Office of Government Commerce v Information Commissioner

[2010] QB 98

[42]The Response submitted that it would not be possible to disclose the requested information in anonymised form with redactions for all personal data, because the Council would not know the extent of relevant information available to others (including volunteered information) and it would be extremely difficult to redact successfully; and that the Commissioner was correct to err on the side of caution given the protection for children’s data.

[43]On Grounds 2 and 3 (Article 6(1)(f)), the Response submitted that the Commissioner found (in the Appellant’s favour) that he was pursuing a legitimate interest; and that the Commissioner considered relevant factors and gave them appropriate weight but concluded the legitimate interest did not outweigh the harm to the candidates’ privacy rights. The Response relied on Common Services Agency (“no presumption in favour of release”) and Blake (data subjects’ interests receive a high degree of protection).

[44]On section 16, the Response quoted section 16(1) FOIA and submitted that the duty to provide advice and assistance generally arises in three circumstances: lack of real name, ambiguity requiring clarification, or section 12 cost-limit reframing; the Response submitted those circumstances did not apply and the duty was not triggered.

[45]The Commissioner invited the Tribunal to dismiss the appeal and agreed the case was suitable for determination on the papers. (7). Appellant’s Reply

[46]The Appellant’s Reply (rule 24) was dated 23 September 2025.

[47]The Reply adopted the Commissioner’s two “steps” from the DN. Step 1 (personal data / identifiability)

[48]The Appellant asserted that the requested information is “almost identical” to that in Lincolnshire (EA/2022/0245) and invited the Tribunal to read that decision, identifying §§57–69 as dealing specifically with section 40.

[49]The Appellant then set out the claimed differences: Lincolnshire involved 3,860 candidates, whereas Kent had 16,446 (citing the Council’s website archive); Lincolnshire requested date of birth rounded to week and did not decide that full DOB would lead to identification; Kent includes Maths, bearing on necessity.

[50]The Appellant relied on ICO guidance on k-anonymisation and stated that the NHS standard for “strong anonymisation” uses k=5; he asserted his request adopted that standard; and he argued that for the in-cohort group each unique DOB would be shared by about 45 candidates on average.

[51]The Appellant characterised the Commissioner’s DN §20 as stating “it is likely” identification could occur but asserted that after Spivack the Commissioner’s position shifted to identification “would” occur.

[52]The Appellant described the Commissioner’s “putative case” (DN §21–22) and argued that it depended on a candidate disclosing part of their score to someone who knows their DOB and the combination being unique; he called this “paradoxical”, asserted such a combination is unlikely; and argued that even if it occurred, the disclosure leading to identification would be made by the data subject themselves.

[53]The Appellant further argued that the Commissioner’s approach impermissibly extends the concept of personal data to circumstances where identification depends on voluntary disclosure by the data subject and, if applied universally, would prevent the publication of anonymous statistics derived from personal data. Step 2 (lawful basis / legitimate interests / necessity / balancing)

[54]The Appellant asserted that, even though the data is not personal data, the Commissioner “spectacularly failed” to establish the legitimate interests by not enquiring what they were.

[55]The Appellant accepted the South Lanarkshire three-question framework but contended the Commissioner misapplied it; he also relied on UT Judge Wikely’s propositions in Goldsmiths as a “roadmap”, particularly proposition 3 (necessity more than desirable but less than indispensable) and proposition 5 (least restrictive means).

[56]On the question of legitimate interests, the Appellant stated that he did not advance detailed legitimate interest arguments during the Commissioner’s investigation because he was not invited to do so. He contended that the Decision Notice’s identification of the relevant legitimate interests was factually inaccurate, noting in particular that the Kent Test operates by reference to a binary pass/fail threshold at a score of 332, rather than by reference to “offers and placements”. He further advanced a detailed research-based and public-policy case, including work undertaken with Professor Alan Bainbridge, analysis of effect size, issues of socio-economic disadvantage, relevant government policy objectives, and the operation of the School Admissions Code.

[57]On necessity, the Appellant asserted that Department for Education and the National Pupil Database do not hold 11+ data; Ofqual does not regulate the 11+; grammar schools allegedly resist independent scrutiny and that therefore FOIA is a necessary last resort. He asserts that Kent’s large cohort provides the sample necessary to calculate age-in-cohort bias and the Maths component is necessary to test a conjecture about subject differences.

[58]On balancing, the Appellant disputed the DN’s “whole world” language (DN §§43–45) and contended that identification to the world could only occur where candidates voluntarily disclose personal data; he characterised the realistic harm as, at most, a narrow risk that a candidate who voluntarily discloses part of their results might (rarely) thereby disclose more than expected to a close associate. Inadequate reasoning / section 16 reframed

[59]Finally, the Appellant reframed his “advice and assistance” ground as one of “inadequate reasoning”: he criticised the Commissioner’s attempt to limit section 16 to three examples; he criticised the absence of any reference to Lincolnshire in the DN; and he contended the DN leaves the parties “guessing” how the request could be reworded when the DN itself suggests that it could be. Hearing

[60]The appeal has been determined without an oral hearing.

[61]Following the case having been decided on the papers, the Appellant wrote to the Tribunal requesting that the appeal be determined at an oral hearing and indicating that he wished to rely upon further evidence. We have carefully considered that request in accordance with the Tribunal Procedure Rules and, in particular, the overriding objective of dealing with cases fairly and justly. Having regard to the fact that the Tribunal has allowed the appeal on the basis of the evidence already before it, we are satisfied that the material issues in the appeal have been fully and fairly determined. In those circumstances, we do not consider that an oral hearing, or the admission of further evidence, would be necessary or proportionate, or that it would add materially to our consideration of the appeal or affect the outcome. We therefore consider it consistent with the overriding objective to determine the appeal without listing a further hearing or inviting or considering any additional evidence. THE LEGAL FRAMEWORK

The statutory right of access and the Tribunal’s jurisdiction

[62]The Freedom of Information Act 2000 (“FOIA”) provides a general right of access to recorded information held by public authorities, subject to the application of statutory exemptions. Section 1(1) FOIA provides that:

“Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”

[63]By section 57(1) FOIA, “where a decision notice has been served, the complainant or the public authority may appeal to the Tribunal against the notice.” Under section 58 FOIA, the Tribunal must consider whether the DN is in accordance with the law and, where the Commissioner has exercised a discretion, whether that discretion should have been exercised differently. The Tribunal exercises a full merits jurisdiction and may make its own findings of fact and law.

Section 40(2) FOIA and the Tribunal’s two-stage approach

[64]Section 40(2) FOIA provides an absolute exemption from disclosure where the requested information constitutes personal data of a person other than the requester and disclosure would contravene any of the data-protection principles.

[65]The determination of the applicability of section 40(2) is ordinarily approached in two stages, which the Tribunal refers to as Step 1 and Step 2.

[66]Step 1 requires the Tribunal to determine whether the information requested constitutes “personal data”, namely information relating to an identified or identifiable living individual. If the information does not amount to personal data, section 40(2) is not engaged.

[67]Step 2 arises only if Step 1 is satisfied. It requires consideration of whether disclosure would be lawful under the UK GDPR—most commonly by reference to Article 6(1)(f)—and whether disclosure would therefore contravene the data-protection principles.

Step 1: Identifiability and anonymous information

[68]The definition of personal data is contained in Article 4(1) UK GDPR, which defines it as:

“any information relating to an identified or identifiable natural person (‘data subject’).”

[69]The concept of identifiability is further explained in Recital UK GDPR, which provides:

“To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.”

[70]Recital 26 further states:

“The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”

[71]The inquiry at Step 1 therefore focuses on whether individuals could realistically be identified in practice by reference to means reasonably likely to be used, rather than on hypothetical or speculative possibilities of identification.

Step 2: Article 6(1)(f) UK GDPR

(f) UK GDPR

[72]Where information constitutes personal data for the purposes of Step 1, it is necessary at Step 2 to consider whether disclosure would be lawful under Article 6 UK GDPR.

[73]In the FOIA context, the lawful basis most commonly relied upon is Article 6(1)(f), which permits processing where:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.”

[74]The application of Article 6(1)(f) involves a structured assessment comprising three stages: 1. identification of the legitimate interest or interests relied upon; 2. consideration of whether disclosure is reasonably necessary to achieve those interests; and 3. a balancing exercise weighing those interests against the rights and interests of the affected data subjects. If reasonable necessity is not established, the balancing exercise does not arise.

Protection of personal data in information rights cases

[75]It is well established that there is no general presumption that transparency overrides privacy where personal data is concerned. The importance of data protection has been repeatedly emphasised in information rights jurisprudence, reflecting the principle that the protection of personal data is a fundamental right.

[76]Those considerations, however, arise only where the information in question constitutes personal data. Where information is properly characterised as anonymous within the meaning of Recital 26, section 40(2) FOIA is not engaged and the data-protection principles do not apply.

Anonymisation and the “motivated intruder” concept

[77]In cases involving anonymised or aggregated information, the Commissioner and the Tribunal have frequently referred to the concept described as the “motivated intruder”. This is not a statutory test, but an analytical tool used to assist in the application of Recital 26.

[78]The motivated intruder is commonly understood as a reasonably competent and determined member of the public, with access to information in the public domain and the ability to draw inferences and to cross-reference information. The concept does not assume specialist technical expertise, insider access, unlawfully obtained information, or criminal conduct.

[79]The purpose of the concept is to assist the Tribunal in assessing whether disclosure would provide a realistic route to identification by reference to means reasonably likely to be used. It does not displace the statutory test set out in the UK GDPR, nor does it permit identifiability to be founded on conjecture or highly contingent factual scenarios.

Section 16 FOIA: advice and assistance

[80]Section 16(1) FOIA provides:

“It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it.”

THE ISSUES

[81]By way of evidence and submissions we considered a bundle consisting of 234 electronic pages. The Tribunal has considered all of this material carefully but does not consider it necessary to refer to all, or indeed most of it, in this judgement.

[82]Having regard to the procedural history and the parties’ pleaded cases, the Tribunal considers that the appeal turns on a small number of tightly defined issues which arise sequentially from the DN and the parties’ subsequent pleadings.

[83]First, the Tribunal must determine, applying the “time-slice” at the date of the Council’s response (15 November 2024), whether the requested dataset as framed by the request (including the Appellant’s express k-threshold safeguard and the exclusion of out-of-cohort candidates) constitutes “personal data” within section 3(2) DPA 2018, by reason of identifiability.

[84]Second, only if the information is personal data, the Tribunal must determine whether disclosure would contravene Article 5(1)(a) UK GDPR, by applying the structured Article 6(1)(f) “legitimate interests” analysis (legitimate interests; necessity; balancing) - including the parties’ competing submissions on the weight and identification of legitimate interests, the availability of less intrusive means, and the scope and reality of any harm/distress in light of children’s privacy expectations and the “disclosure to the world” character of FOIA disclosure.

[85]Third, the Tribunal must address the Appellant’s procedural/adequacy criticisms, in particular whether the Decision Notice’s concluding invitation to “remake” or “reword” the request is consistent with a sufficiently reasoned determination and/or engages any duty of advice and assistance under section 16 FOIA in the circumstances.

[86]So in summary, the issues for determination are:(1) Whether the requested information, as sought and subject to the Appellant’s proposed safeguards, constitutes personal data because individuals are identifiable. This is the gateway question for section 40(2).

(2) If so, whether disclosure would contravene the first data protection principle, having regard in particular to Article 6(1)(f) UK GDPR. We must apply the structured three-question approach (legitimate interests; necessity; balancing).

(3) Whether the decision notice is vitiated by inadequate reasoning and/or a failure to comply with section 16 FOIA. DISCUSSION AND FINDINGS A. Scope

[87]We begin by identifying the correct temporal and conceptual frame. The Commissioner relies on the “time slice” principle: the question whether an exemption is engaged falls to be determined as at the date of the public authority’s response (or, if late, the expiry of the statutory period), applying Montague v IC and DIT and Keighley v IC & BBC. The Commissioner states expressly that, on this footing, the relevant date here is 15 November2024, being the date of the Council’s response.

[88]We accept that approach. Our task is therefore to decide whether, as of 15 November 2024, the Council was entitled to refuse the request by reliance on section 40(2) FOIA.

[89]A further threshold point is the Commissioner’s statement that although the Appellant argues that suitable redactions can anonymise the data, the Commissioner “must consider whether the council was correct to apply section 40(2) to the information which was actually requested”, because the council “is required to respond to the request that was made; it is not required to work out what information, similar to that requested, would not be personal data.” . The Commissioner therefore frames the issue as whether “the information, as requested” is exempt under section 40(2).

[90]The Commissioner is correct as a matter of principle that a public authority is ordinarily required to answer the request made and is not obliged to devise alternative formulations. However, that principle does not assist the Commissioner in the way the DN suggests, because the Appellant’s request itself expressly stipulated a key redaction—excluding any results where fewer than five candidates share the same birth date.

[91]This is not a case where the Appellant is asking the Commissioner (or the Council) to imagine a different request. The “request as actually requested” already incorporates anonymisation. The Commissioner’s framing risks treating the request as if it sought unredacted individual-level DOB and score data. It did not. The request, as recorded in the DN and in the Council correspondence, expressly included safeguards: exclusion of results where fewer than five children shared a birth date, and a request to redact any results outside the normal cohort age range (and provide a count of those removed).

[92]This point is central because the Step 1 identifiability assessment must be performed on the dataset as disclosed under the request, i.e. including the built-in k-threshold safeguard. The Appellant makes this criticism repeatedly in the appeal materials.

[93]Accordingly, the “request as made” includes (and must be analysed by reference to) those safeguards. It is not a case where the Tribunal is being asked to invent a different request; the Appellant built anonymisation features into the request itself. B. Issue 1 (Step 1): does the requested information constitute “personal data” i. The Commissioner’s Step 1 reasoning and “scenarios”

[94]On Step 1, the Commissioner’s conclusion is that the information falls within the definition of personal data because “there are scenarios in which it is likely that individuals could be identified” from the information requested.

[95]The Commissioner gives two principal examples.

[96]First, where a child has shared their individual score on one part of the test with another child or a third-party parent who also knows the child’s date of birth: if the combination of birth date and that known score is unique, the third-party could identify the child within the dataset and then learn the scores in the other parts of the test. The Commissioner states he is satisfied that if the combination is unique, the child would be identifiable.

[97]Second, where a child has told a third-party parent their score for one part of the test and that score is unique (particularly because it is very high or very low): the child would be identifiable to that parent within the dataset and the other scores and date of birth would then be relatable to that child.

[98]The Commissioner then concludes that the requested information, combined with existing knowledge held by some individuals as described, would allow individual children to be identified, and therefore the information falls within the definition of personal data.

[99]The Commissioner’s Response expands the Step 1 case by emphasising the Council’s internal review figures:

“when combining standardised, raw scores and dates of birth, 16369 of the 16388 permutations occur so infrequently that they fall below the threshold of 5 or less… 12500 of the permutations are completely unique within the dataset.”

[100]The Commissioner submits that friends/classmates/family “are likely to know some of the requested information” (DOB; and some scores disclosed “in part or in full”), and that it is “reasonably likely” that at least one member of the public could correctly identify a child from the dataset and learn something new.

[101]The Commissioner further submits that Spivack does not assist the Appellant because the circumstances differ: in Spivack there were “a variety of possible reasons” why a person might appear in the data, whereas here there is “no other reason” for a candidate to appear, save that they took the Kent Test.

[102]The Commissioner adds a practical submission: it would not be possible to disclose in anonymised form with redactions for all personal data because the Council would not know what information has been “volunteered” by candidates/parents; ensuring no child was identifiable “would be extremely difficult”; and given the special protection for children’s personal data, the Commissioner was right to “err on the side of caution.” (ii). The Appellant’s ‘Step 1’ submissions

[103]The Appellant frames Step 1 as a question of identifiability under the “motivated intruder” approach and relies heavily on Lincolnshire as a close comparator. He submits the requested information (anonymised results plus dates of birth) is “almost identical” to Lincolnshire, where section 40(2) was held not to be engaged; he directs attention to paragraphs 57–69 of that decision on section 40.

[104]The Appellant identifies differences: 1. Kent’s cohort is far larger—around 16,446 candidates (he contrasts Lincolnshire’s 3,860); 2. Lincolnshire involved week-of-birth aggregation and does not decide that full DOB would lead to identification; 3. Kent includes 3 subject components, including Mathematics. This difference does not bear on the identifiability analysis at Step 1, but is relied upon by the Appellant at Step 2 when addressing necessity.

[105]He relies on “k-anonymisation” (including ICO anonymisation guidance), noting the NHS standard for “strong anonymisation” uses k=5; he says his request adopted that standard by excluding dates shared by fewer than five candidates.

[106]The Appellant quantifies the cohort logic: births in the relevant period are shared by about 45 candidates per date on average, and out-of-cohort candidates (who might be unique) can be removed.

[107]He attacks the Commissioner’s “scenario” as paradoxical and improbable: it depends on a candidate voluntarily disclosing part of their result to a close associate but simultaneously not wishing that associate to know their full results; and it depends on partial results being unique. Even if such a scenario arose, he submits, the disclosure leading to identification would be the disclosure made by the data subject themselves.

[108]The Appellant submits that, if the Commissioner’s reasoning were applied generally, it would prevent publication of any anonymised statistical figures derived from personal data, because voluntary disclosure could always occur. (iii) The legal test

[109]The Commissioner’s Response sets out the legal framework in some detail, including Recital 26 GDPR; the Article 29 Working Party Opinion warning that mere hypothetical possibility is not enough; the ICO “motivated intruder” guidance; Magherafelt, Miller and Morton; and the CJEU’s statement in Breyer that the risk of identification must “in reality… be insignificant” to be treated as anonymous.

[110]The Commissioner further cites the FTT and UT decisions in Spivack for the propositions that identification requires a “degree of certainty”, that an individual must be distinguished from others, and that an educated guess is insufficient.

[111]We accept those legal propositions. They provide the correct frame for our analysis. (iv) Does the Commissioner’s scenario satisfy the legal threshold?

[112]The Commissioner’s Step 1 conclusion rests on a series of “scenarios” involving a third-party parent (or another child) who already knows both(i) a candidate’s date of birth and

(ii) one score, or partial score.

[113]That scenario does not, on its face, involve a motivated intruder operating otherwise than by reference to relationship-based or insider knowledge. Rather, it presupposes relationship-based knowledge held by a parent or child, which is a form of pre-existing knowledge of the kind acknowledged in the Commissioner’s own anonymisation guidance as sometimes capable of bearing on identifiability.

[114]The correct question, however, remains whether—treating the disclosure as one made under FOIA to the public at large—individual children would be identifiable, having regard to all means reasonably likely to be used.

[115]In addressing that question, the Tribunal has had regard to the “motivated intruder” concept as set out in ICO guidance. The motivated intruder is assumed to be a reasonably competent and determined member of the public, with access to information in the public domain and the ability to cross-reference such material and draw inferences from it. They are not assumed to possess specialist expertise, insider or relationship-specific knowledge, or to engage in unlawful activity. The issue is whether disclosure, when combined with information reasonably available to the public, would enable identification of individuals or otherwise reveal personal data.

[116]We accept, as a general proposition, that identifiability can sometimes arise, in some circumstances, where a person or small group already knows a great deal about another individual.

[117]However, the Commissioner must still demonstrate that the disclosed information allows one individual to be distinguished from others through a reliable connection, as opposed to speculative or conjectural inference.

[118]We are not satisfied that the Commissioner has done so here, for the following reasons.

[119]First, the Appellant’s request incorporates a structural safeguard, namely redaction where fewer than five candidates share a date of birth. This removes the small-cohort or outlier cases which would most obviously present a risk of singling out.

[120]Secondly, the Commissioner’s scenarios depend upon a third-party having advance knowledge of both an individual’s date of birth and a unique score. Even if that premise is accepted in some cases, Spivack requires the Tribunal to assess whether disclosure enables identification through a reliable and meaningful connection, not whether identification could arise as a matter of possibility in a limited and highly contingent scenario.

[121]Thirdly, the Commissioner’s analysis does not engage with the dilution effect arising from cohort size. The Appellant’s evidence and submissions proceed on the basis that approximately 45 candidates share any given date of birth within the relevant cohort.

[122]That point is not merely rhetorical. It means that date of birth, even if known, does not of itself single out an individual. The Commissioner’s analysis therefore turns on the asserted uniqueness of scores or combinations of scores, rather than date of birth.

[123]The effect of the request’s stipulated safeguards is that the disclosed dataset would be materially constrained. In particular, any date of birth shared by fewer than five candidates would be removed, and any candidates falling outside the normal cohort age range would be excluded altogether. The disclosure would therefore not include rare or extreme values, nor would it reveal individual-level dates of birth capable of singling out candidates by reference to age. These features of the request are not peripheral: they define the information that would in fact be disclosed and therefore form part of the proper foundation for the identifiability assessment at Step 1.

[124]As a consequence of the request being framed in this way, the information to be disclosed would not include full dates of birth operating as quasi-identifiers. Rather, any dates of birth that might otherwise be unique or reveal outliers would be removed by operation of the request’s own safeguards. The identifiability analysis at Step 1 must therefore proceed on the basis of a dataset from which the most powerful linkage variables have already been stripped out, and not by reference to a hypothetical disclosure of raw or unconstrained personal attributes.

[125]Against that background, we turn to the Commissioner’s reliance on the proposition that certain examination scores are unique and that this uniqueness is sufficient, of itself, to render the corresponding individuals identifiable. We do not accept that submission. The fact that a particular score is unique within a cohort establishes only that one candidate achieved that score; it does not, without more, provide a realistic or reliable means by which that candidate could be identified in practice. In the absence of dates of birth or other quasi-identifiers, the Commissioner’s scenarios depend either upon voluntary self-disclosure by the candidate or relationship-specific prior knowledge held by parents, peers or others. Such pathways do not amount to ‘means reasonably likely to be used’ for the purposes of Recital 26, nor do they demonstrate that identification would arise as a consequence of the disclosure itself.

[126]Fourthly, the Commissioner’s reliance on “uniqueness”, derived from the permutations figures, is misplaced if treated as determinative. The mere fact that a combination of variables is unique within a dataset does not of itself render the data identifiable. What matters is whether there exists a realistic and reliable route by which that unique combination can be connected to an identified individual in the world outside the dataset.

[127]The route relied upon by the Commissioner is said to lie in prior knowledge held by some parents or children, namely a date of birth together with one score. However, the Commissioner does not demonstrate that such prior knowledge, when combined with the disclosed dataset and taking account of the safeguards in place, would enable identification by way of a reliable connection. At its highest, the case advanced establishes only the possibility of inference in a limited and contingent set of circumstances, rather than a connection sufficient to render the data personal.

[128]For completeness, the Tribunal emphasises that it has reached its conclusions on the basis of its own assessment of the evidence and applicable legal principles. In referring to Spivack v Information Commissioner, the Tribunal recognises that it is a decision of the First-tier Tribunal and is not binding or authoritative. It is relied upon only as a persuasive illustration of the correct analytical approach, namely that identifiability depends upon the existence of a reliable connection between the data and an individual, rather than the mere possibility of inference in hypothetical circumstances.

[129]Fifthly, the Commissioner’s formulation that “at least one person could identify at least one candidate” is, as a general proposition, capable of being correct in some datasets.

[130]However, in this dataset, the Commissioner does not demonstrate that such identification is reasonably likely in reality once the request’s own anonymisation measures are applied, rather than amounting to a mere hypothetical possibility of the kind cautioned against by Recital 26 and Opinion 4/2007. (v) The Commissioner’s “difficulty of redaction” and “err on the side of caution” point

[131]The Commissioner submits that effective redaction is “extremely difficult” because the Council cannot know what information individual candidates or parents may have volunteered to others and therefore cannot know what must be redacted in order to prevent identification.

[132]We accept that absolute or perfect anonymity can rarely be guaranteed, particularly in the context of large or complex datasets.

[133]However, the applicable legal standard is not the elimination of all conceivable risk. The question is whether, considering all means reasonably likely to be used, identification is realistic rather than hypothetical or speculative.

[134]Properly analysed, the Commissioner’s “volunteered information” point concerns the consequences of choices made by data subjects themselves, or by their parents, to disclose information to others.

[135]That is a relevant contextual consideration, but it cannot, without more, convert information that is otherwise anonymous into personal data merely because a data subject may choose to render themselves identifiable to another individual. As the Appellant submits, FOIA identifiability cannot turn on the possibility of voluntary self-disclosure by those to whom the data relates.

[136]Put another way, the Commissioner’s approach risks collapsing into the proposition that anonymisation fails whenever a data subject might share one or more attributes with another person. That formulation is too broad and would sit uneasily with the concept of anonymous data expressly recognised in Recital 26.

[137]Accordingly, whilst we accept that the Council must proceed responsibly and with appropriate caution, the Commissioner’s reliance on an obligation to “err on the side of caution” does not bridge the analytical gap. It does not demonstrate that, once the request’s own safeguards are applied, identification in practice is realistic, as opposed to resting on conjecture or voluntary self-disclosure. (vi). The Commissioner’s distinction of Spivack

[138]The Commissioner distinguishes Spivack by saying that, in that case, there were multiple reasons why an individual might appear in the dataset, whereas here the only reason is that the candidate sat the Kent Test.

[139]We accept that the contexts differ.

[140]But the core proposition in Spivack is that identification requires more than an educated guess: the information must allow one individual to be distinguished from others by way of a reliable connection. Being merely in a position to guess correctly, in the absence of such a connection, is insufficient.

[141]The Commissioner’s distinction does not answer the Appellant’s point that, with DOB shared by many candidates and with safeguards excluding low-k dates, the dataset does not permit reliable singling out.

[142]We therefore do not consider the Spivack distinction sufficient to uphold the Step 1 conclusion.

[143]We reiterate, in relying on Spivack v Information Commissioner, the Tribunal is mindful that it is a decision of the First-tier Tribunal and is not binding or authoritative. The Tribunal does not treat Spivack as laying down a freestanding legal test. Rather, it is relied upon for the assistance of its reasoning, insofar as it reflects and illustrates established principles applicable to identifiability, including the distinction between identification by way of a reliable connection and identification resting on conjecture or educated guesswork. The relevance of Spivack in the present context lies not in its factual matrix, but in its articulation of that analytical distinction, which the Tribunal considers of general application. (vi). Engagement with Lincolnshire

[144]The Appellant relies strongly on Lincolnshire as a near-match comparator and complains that the DN contains no reference to it, despite it having been drawn to the Commissioner’s attention.

[145]The Commissioner’s documents do not demonstrate a reasoned explanation of why Lincolnshire is distinguishable on the identifiability issue (as opposed to merely stating the legal test).

[146]We accept that FTT decisions are not binding. But where a materially similar Tribunal decision has been squarely relied upon as part of a party’s submissions, the absence of meaningful engagement with that decision – beyond a recitation of the applicable legal test – may give rise to a concern as to the adequacy of reasoning. That omission forms part of the Appellant’s wider criticism of the adequacy of the DN’s reasoning.

[147]Before drawing our conclusions on Step 1, we make the following clarification as to the legal standard we have applied. For the avoidance of doubt, we emphasise that our conclusion on identifiability is not reached by applying an unduly exacting or unrealistic threshold. We do not require proof of actual identification, nor do we treat the absence of certainty as determinative. The correct test, derived from Recital 26 UK GDPR and the authorities cited above, is whether identification would be reasonably likely in practice by reference to means reasonably likely to be used, rather than resting on speculative, contingent or purely theoretical possibilities. We have approached that question on the footing that identifiability may, in some circumstances, arise even where the risk is confined to a small subset of cases or a limited audience. However, having assessed the dataset as it would in fact be disclosed under the request — including the express k-threshold safeguard and the exclusion of out-of-cohort candidates — we are not satisfied that the pathways relied upon by the Commissioner amount to more than hypothetical scenarios dependent on voluntary disclosures or relationship-specific prior knowledge. In our judgment, such scenarios do not establish a realistic or reliable route by which individuals would be identified as a consequence of the disclosure itself. Even adopting the Commissioner’s formulation of “reasonable likelihood”, the risk of identification here remains too remote, once properly analysed, to render the information personal data within the meaning of Article 4(1) UK GDPR and Recital 26. (vii). Conclusion on Step 1

[148]Drawing the analysis together, the Tribunal is not satisfied that the Commissioner has demonstrated that disclosure of the requested information, treated as disclosure under FOIA to the public at large and subject to the request’s own anonymisation measures, would make it possible in practice to identify living individuals by reference to means reasonably likely to be used. The Commissioner has not identified any objective mechanism inherent in the dataset that would enable members of the public to single out individuals without recourse to conjecture or external contingencies.

[149]In particular, the scenarios advanced depend upon the existence of additional information held by specific parents or children, or upon voluntary self-disclosure by the data subjects themselves. Such possibilities do not constitute means reasonably likely to be used by the public at large, nor do they establish a realistic pathway by which the data disclosed could be linked to identified individuals as a consequence of the disclosure itself.

[150]Assessing the matter objectively and having regard to the safeguards incorporated into the request, the Tribunal is not persuaded that disclosure would render individuals identifiable in the sense required by Recital 26. What remains are theoretical or incidental possibilities of identification, rather than identification arising from the data through means reasonably likely to be employed.

[151]Section 40(2) is therefore not engaged. The information disclosed, subject to the request’s built-in safeguards, constitutes anonymous information rather than personal data. C.

(f) — lawful processing

[152]In light of our conclusion on Step 1, Step 2 does not strictly arise. However, Article 6(1)(f) was fully argued before us, and the Commissioner’s DN proceeds on that basis. We therefore address it in the alternative, in case we are wrong in our conclusion on Step 1.

[153]The Commissioner identifies Article 6(1)(f) as the relevant lawful basis for processing and correctly sets out the applicable three-stage test:(i) the existence of legitimate interests;

(ii) necessity; and

(iii) the balancing exercise. He further recognises that the necessity limb must be satisfied before the balancing exercise is undertaken.

[154]The Commissioner concludes that legitimate interests exist, framed in terms of transparency and oversight; that disclosure is necessary and that no less intrusive means are available; but that the balancing exercise favours non-disclosure because children would not reasonably expect their dates of birth and test scores to be disclosed to the public at large, and because disclosure could cause distress to affected individuals.

[155]In his Reply, the Appellant challenges the Commissioner’s analysis of legitimate interests on two grounds.

[156]First, he submits that the Commissioner failed to identify or explore the Appellant’s legitimate interests during the investigation, such that those interests were articulated in full only on appeal.

[157]Secondly, he contends that the Commissioner’s formulation of the legitimate interests pursued—described as oversight of school offers and placements—is factually inapt. He submits that, in Kent, outcomes communicated to parents are essentially pass/fail against the grammar assessment threshold, whereas his interest lies in age standardisation, cohort effects, and fairness, rather than placements as such.

[158]The Appellant then sets out a detailed legitimate interest case, grounded in research concerning socio-economic disadvantage and age-in-cohort effects, governmental policy statements on disadvantage in selective admissions, and determinations of the Schools Adjudicator indicating that lack of age standardisation may render an admissions test unfair.

(i) Legitimate interests

[159]We accept that entitlements under FOIA are applicant- and motive-blind, in the sense that a requester’s motive is not determinative of the right to information.

[160]However, where Article 6(1)(f) is relied upon, the decision-maker is required to identify the legitimate interests pursued and to weigh them. It is lawful for a decision-maker to identify general transparency as a legitimate interest.

[161]In the present case, however, the Appellant’s evidence discloses specific and non-trivial legitimate interests (as detailed in the Appellant’s witness statement and reply in particular), namely independent research into the fairness of admissions testing affecting large cohorts of children, with potential relevance to public policy debates concerning disadvantage and selection.

[162]The Commissioner’s DN does not engage with those specific interests. On the Appellant’s unchallenged account, they were not sought from him during the course of the investigation.

[163]We consider that omission to be material, given that the Commissioner then proceeded to afford determinative weight to privacy impacts without having articulated or evaluated the legitimate interests at their proper strength. (ii). Necessity

[164]The Appellant advances a detailed case on necessity. He explains that the Department for Education does not hold the data sought; the National Pupil Database does not contain it; the 11+ is not regulated by Ofqual; grammar schools and relevant bodies are resistant to data sharing; and that FOIA is therefore the only realistic route to access. He further submits that Kent is uniquely valuable by reason of cohort size and the inclusion of mathematics.

[165]On necessity, while the DN reaches a conclusion in the Appellant’s favour (necessity is met), it does so without engaging with the Appellant’s detailed necessity case. We agree that, on these materials, the “reasonable necessity” threshold discussed in Goldsmiths v ICO and the Home Office would be satisfied. We record that the Appellant’s necessity evidence materially strengthens the case for disclosure if balancing is required. (iii). The balancing exercise

[166]The Commissioner’s balancing analysis is set out at §§39–47 of the DN. He places weight on the reasonable expectations of privacy; the fact that children would not expect their dates of birth and test scores to be disclosed to the public at large; the potential for distress to identifiable children, particularly those with poor results; the breadth of FOIA disclosure as compared with voluntary sharing with friends or family; and concludes that the legitimate interests identified do not outweigh the rights and interests of the children concerned.

[167]The Appellant responds that the “whole world” framing is overstated. He submits that the only plausible route to identification arises where a child has voluntarily disclosed partial information to a close associate, and that the realistic harm in such cases is limited to the possibility that the child may reveal more than intended to that one individual.

[168]We accept as a general proposition that children reasonably expect their test results not to be published in identifying form, and that the rights and freedoms of child data subjects’ merit particular protection.

[169]We agree with the Commissioner that disclosure under FOIA is disclosure to the public at large as a matter of legal character, as confirmed in Office of Government Commerce v Information Commissioner.

[170]However, the central question in the balancing exercise is not merely the theoretical breadth of disclosure, but its practical impact. Where information is anonymised such that identification is not realistically enabled, the weight to be attached to the “whole world” character of FOIA disclosure correspondingly diminishes, because the public at large would be unable to connect the data to identified individuals.

[171]In that respect, the Commissioner’s balancing analysis is contingent upon the conclusion at Step 1 that identifiable personal data would be disclosed. As we do not accept that conclusion for the reasons set out above, the analysis of distress and reasonable expectations is substantially weakened.

[172]Even if we were wrong on Step 1, we would observe that the Commissioner’s balancing analysis does not engage with the request’s own safeguards, including the k≥5 threshold and the exclusion of outliers, which materially reduce the likelihood that any child could be identified in a manner giving rise to distress or unwarranted intrusion.

[173]The DN’s reasoning therefore overstates harm by treating a narrow, contingent inference scenario as tantamount to publication of a child’s identifiable results to the world. We find that this is not justified on the materials. (iv) Common Services Agency v Scottish Information Commissioner and Blake v Information Commissioner

[174]The Commissioner reminds the Tribunal that there is no presumption that transparency overrides privacy, relying on Common Services Agency v Scottish Information Commissioner and Blake v Information Commissioner for the high level of protection afforded to personal data.

[175]We accept those propositions.

[176]They do not, however, determine the present appeal. Both authorities concern circumstances in which personal data was in issue. Where information can properly be disclosed in anonymised form such that section 40(2) is not engaged, those authorities do not mandate non-disclosure. D. Issue 3: Section 16 FOIA and adequacy of reasoning

[177]Given our conclusions on the substantive issues above, it is not necessary to reach a determination on the Appellant’s section 16 FOIA ground. That issue does not affect the outcome of the appeal, which turns on whether section 40(2) is engaged. We therefore express no concluded view on section 16. Conclusion

[178]For the reasons set out above, we conclude that the Commissioner’s DN is not in accordance with the law. The Decision Notice proceeds on the basis that the requested dataset, notwithstanding its built-in safeguards, constitutes personal data, without adequately demonstrating that disclosure would enable identification by reference to means reasonably likely to be used. It then undertakes a balancing exercise under section 40(2) FOIA and Article 6 which is dependent on that initial assessment.

[179]It follows that section 40(2) FOIA is not engaged, and the appeal is therefore allowed. Signed Date: Judge Kiai 19 May 2026